Skip to content

None of the AWS fundamentals work

0

I've spent hours and days debugging API gateway integrations with Lambda, Cognito & other API gateways. None of your systems work.

Cloudwatch logging often doesn't appear when it should. API gateway authorizers think they're using IAM when they're configure for Cognito. Wiring up Lambda function is a major pain.

Why would anyone build their company on AWS? The only thing that works consistently is EC2.

3 Answers
0
    I understand your frustration with AWS integrations. These challenges are common when working with API Gateway, Lambda, and Cognito integrations.

    For API Gateway and Lambda integration issues:
    - 404 errors often indicate route configuration problems. Your local route (e.g., /api/Supplier/GetTotal) needs to match exactly what's configured in API Gateway.
    - After making changes to API Gateway, you need to deploy the API for changes to take effect.
    - Lambda permissions are critical - API Gateway needs explicit permission to invoke your Lambda functions. This is often missed when setting up integrations through CloudFormation or OpenAPI specifications.

    For Cognito integration issues:
    - OAuth Scopes configuration can cause 4xx errors if misconfigured. Leave it blank for identity token authorization or configure it properly for access token authorization.
    - 401 Unauthorized errors are common with Cognito integrations and often require specific troubleshooting.
    - Pre-token generation Lambda triggers can cause HTTP 500 errors if they fail.

    For debugging:
    - Enable CloudWatch logging for your API Gateway to see detailed error information.
    - Check for integration error messages by adding appropriate logging variables.
    - Sometimes toggling between proxy/non-proxy integration settings can resolve issues.

    While these services can be challenging to integrate, they do work reliably once properly configured. The initial setup complexity is the trade-off for the scalability and managed service benefits that AWS provides beyond EC2.
  

Sources
AWS Gateway: API does not respond in Postman | AWS re:Post
Api Gateway is not sending Cognito data to Lambda | AWS re:Post
Creating api gateway api from openapi specification with lambda integration does not create triggers | AWS re:Post
Troubleshooting issues with HTTP API Lambda integrations - Amazon API Gateway
Create and troubleshoot Cognito and API Gateway integrations | AWS re:Post

answered a year ago

  • Ok, but the docs don't match the options. For example, in this link https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html it states:

    1. To use an access token, do the following:

      a. For Authorization Scopes, enter one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the example given in Create an Amazon Cognito user pool for a REST API, one of the scopes is https://my-petstore-api.example.com/cats.read.

      At runtime, the method call succeeds if any scope that's specified on the method in this step matches a scope that's claimed in the incoming token. Otherwise, the call fails with a 401 >Unauthorized response.

      b. Choose Save.

    ...but no such "Authorization Scopes" field exists.

0

Not to mention that the documentation is 50% headers with wordy but utterly useless content.

answered a year ago

0

hey there! sorry that you are having issues, let me help you with those by using AWS CloudFormation - an AWS service for Infrastructure as Code (IaC) where you can define your needed resources and deploy them easily without going through the Management Console.

here is the CF template which your can use to create an API Gateway with implemented Cognito Authorizer and one Lambda which is protected by the mentioned authorizer:

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: >
  Example of CloudFormation Template

Parameters:
  UserPoolArn:
    Type: String
    Description: User Pool ARN from the Auth stack

Resources:
  RestApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !Ref UserPoolArn
            Identity:
              Header: Authorization
        AddDefaultAuthorizerToCorsPreflight: false
      Cors:
        AllowMethods: "'*'"
        AllowHeaders: "'*'"
        AllowOrigin: "'*'"

  # Lambda Functions
  YourLambda:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.12
      Handler: lambda_handler.lambda_handler
      CodeUri: ./
      Policies:
        - AWSLambdaBasicExecutionRole
      Events:
        GetEvents:
          Type: Api
          Properties:
            RestApiId: !Ref RestApi
            Path: /your-needed-route
            Method: get

for deploying this template, you will need AWS Serverless Application Model - https://aws.amazon.com/serverless/sam/. take a look into the documentation, i had no issues using it and learning it when i installed it for the first time. if you are interested in seeing how to define other resources inside the same template, i've created a project with multiple Lambdas covered by API Gateway + Cognito Authorizer and multiple other services like DynamoDB, CloudFront and S3 - https://github.com/mate329/eventspark/blob/master/aws/EventsStack/template.yaml.

let me know if you have any other questions and if i can help you in any other way :)

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.